--- title: "Google SAML Login" description: "How do you log in using Google SAML, and how do admins set it up for their Organization?" url: https://support.mosaicapp.com/en/articles/197-google-saml-login collection: "Admin Hub - Security" updated: 2026-11-06 language: en --- # Google SAML Login How do you log in using Google SAML, and how do admins set it up for their Organization? This documentation only applies to Organizations using Google SAML login. If your Organization uses a [different login method](https://support.mosaicapp.com/en/articles/193-Authentication.md), consult the appropriate documentation. Google SAML is a provider for [Single-Sign On (SSO) Login](https://support.mosaicapp.com/en/articles/196-Single-Sign-On-\(SSO\)-Login.md). # Using Google SAML 1. Go to Mosaic log in page and enter your email. Click **Next.** ![](https://staticfiles.gleap.io/ghelparticle/mHJTsjNrSOF8FTSv3Sxly64gFQ7AphWetMOYOMhWYBYc4eRmikTWIKSS6Is3szfWz1TAwtP76tb.png) 2. You will be redirected to the Google log in page. 3. Enter your password for your Google account, and click **Sign in**. # Setting up Google SAML for your Organization This section is for Organization admins. It walks through configuring Google SAML so your members can use the log-in steps above. ## Initial Setup with Google SAML 1. Create a Group on Google Workspace. - Navigate to Groups and select Create Group. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154813_9062.png) - Then fill out the fields however you'd like. Making sure to select the `Security` box at the bottom. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154817_3829.png) - You can set the Access type to however you'd like to manage the `Group`, then add Users to the `Group`. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154818_3422.png) 2. Navigate to **Apps** → **Web and mobile apps** ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154820_8874.png) 3. Click on **App app** → **Add custom SAML app** ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154821_1998.png) 4. Enter a custom **App name**. You can also add an _optional_ description and an _optional_ app icon. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154822_3857.png) 5. On the **Google Identity Provider details** page, use **Option 2: Copy the SSO URL, entity ID and certificate**. You will need to copy over the **SSO URL** and **Certificate** onto Mosaic in Step #7. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154823_6001.png) ## Add and Verify Domain on Mosaic 1. Go to **Mosaic Settings** → **Authentication** page. Under **SAML 2.0 Single Sign On**, click `Manage Domains`. > Please Note: > > Only **admins** are able to access the **Authentication** tab on Mosaic settings. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154824_3564.png) 2. Select `+ Domain` on the Verified Domains Modal. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154825_2668.png) 3. Enter a your email domain in the host name field. Click `Add Domain`. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154826_1750.png) 4. Newly added domain will appear on the modal with status **Not Verified**. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154827_6436.png) 5. Share the Hostname, Record Type (TXT), and Record Value with your DevOps team to update the domain’s DNS settings. Click `Verify Ownership` after completing the DNS configuration. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154828_3619.png) 6. The domain’s status will update to Verified. > Domains with status Not Verified display a Delete option and can be removed. Once a domain is marked as Verified, the Delete option is no longer available. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154829_8958.png) ## Setup SAML 1. Click `Enable` **SAML 2.0 Single Sign On** on Authentication page. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154830_7157.png) 2. On Mosaic’s **SAML 2.0 Single Sign On** menu, fill in: - **SSO URL**: - SSO URL copied from **Option 2: Copy the SSO URL and certificate** in Step #5. - **Certificate**: - Certificate copied from **Option 2: Copy the SSO URL and certificate** in Step #5. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154831_7490.png) ### Back on the Google Identity Provider details page 1. Copy and paste the **ACS URL** and **Entity ID** from Mosaic’s **SAML 2.0 Single Sign On** menu to Google’s **Service provider details** section; all other fields can remain untouched. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154832_2433.png) 2. Next, configure the attribute mapping between Google Directory and App: 3. Map the Google Directory attributes to the App attributes as follows: - Primary email -> email - First name -> first\_name - Last name -> last\_name - Department -> team\_department - Title -> team\_title 4. Under **Group membership (optional) > Google groups**, add the `Group` created in Step #1 to the list of Groups. 5. Under **Group membership (optional) > App attribute**, enter `security_group`. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155017_2880.png) - Upon successful setup, users will be able to see the custom SAML app in Google Workspace’s **Web and mobile apps** section. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155018_0331.png) 6. By default, access to the new custom SAML app is turned **OFF for everyone** on Google Workspace. - To make the app available, click on the new custom SAML app. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155019_2651.png) - Click on **User access** and then click on **Groups** and select the `Group` you created. Checking the `Service Status` on box. Then **Save**. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155020_2566.png) > Setting up Multiple Teams with SAML: > > To set up multiple teams with SAML simply create another group and add users to that group. **(Users can only be in 1 group!)** > > When setting up SAML on the new Mosaic team. **Skip the step to copy the`ACS URL` and the `Entity ID`.** > > On the SAML app, you will also need to select all groups you want added in the mappings section. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155021_8783.png) ## Add Domain and Security Group on Mosaic page 1. Click `+Add Domain` to select Domain for SAML set up. This will be the Domain associated with Google Workspace. For example, `account1@thisisdomain.com` has a domain of `thisisdomain.com`. > Please Note: > > The email associated with the admin (who is setting up the SAML) must have the same domain as the one being inputted. > > For example, if the admin uses an email `account1@thisisdomain.com`, the only domain the admin could input is `thisisdomain.com`. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155022_3661.png) > Both Verified and Unverified domains are displayed in the list. However, only Verified domains can be selected. Domains that are already added will appear greyed out. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155023_4836.png) 2. Configure the Security Group under the domain. Enter the security group name in the security group ID field. Choose the desired access level from the dropdown menu. Optional: Select `Include accounts without a security group` to allow accounts not assigned to any Security Group to log in while retaining their current access level. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155024_7521.png) 3. Click **Done** on the top once all configuration is completed. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155025_5947.png) - Upon successful activation, **SAML 2.0 Single Sign On** will have the following options: ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155026_1313.png) Next time a user with an email address belonging to the specified domain logs into Mosaic, they will be redirected to authenticate with Google the moment they click **Next** after inputting their email. ![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155028_9258.png)